Privacy Policy

Introduction and overview

We have prepared this privacy policy (version 21.07.2024-112837363) to explain, in accordance with the General Data Protection Regulation (EU) 2016/679 and applicable national laws, which personal data (data for short) we, as controller, and the processors we commission (such as providers) process, will process in future, and what lawful options you have. The terms used are gender-neutral.
In brief: We provide comprehensive information about the data we process about you.

Privacy policies usually sound very technical and use legal terminology. This policy, however, aims to explain the most important points as simply and transparently as possible. Where it improves transparency, technical terms are explained in a reader-friendly way, links to further information are provided and graphics are used. We explain in clear and simple language that, in our business activities, we process personal data only when an appropriate legal basis exists. This cannot be achieved through the brief, unclear, legalistic explanations often found online in relation to privacy. I hope you find the following explanations interesting and informative, and perhaps learn something new.
If you still have questions, please contact the responsible person or body named below or in the legal notice, follow the links provided and consult further information on third-party websites. Our contact details are also available in the legal notice.

Scope

This privacy policy applies to all personal data processed by our company and to all personal data processed by companies we commission (processors). By personal data, we mean information within the meaning of Article 4(1) GDPR, such as a person's name, email address and postal address. Processing personal data enables us to offer and bill for our services and products, online or offline. This privacy policy covers:

• all online presences (websites and online shops) that we operate
• social media presences and email communication
• mobile apps for smartphones and other devices

In brief: This policy applies to all areas where personal data is processed in a structured way within our company through the channels listed above. If we enter into legal relationships with you outside these channels, we will inform you separately where appropriate.

Legal bases

In this privacy policy, we provide transparent information about the legal principles and provisions, namely the legal bases under the General Data Protection Regulation, that allow us to process personal data.
Regarding EU law, we refer to REGULATION (EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 27 April 2016. You can read this EU General Data Protection Regulation online on EUR-Lex, the gateway to EU law, at https://eur-lex.europa.eu/legal-content/DE/ALL/?uri=celex%3A32016R0679.

We process your data only if at least one of the following conditions applies:

1. Consent (Article 6(1)(a) GDPR): You have given us permission to process data for a specific purpose. One example is storing the data you enter in a contact form.
2. Contract (Article 6(1)(b) GDPR): We process your data to fulfil a contract or pre-contractual obligations with you. For example, if we conclude a purchase contract with you, we need personal information beforehand.
3. Legal obligation (Article 6(1)(c) GDPR): We process your data when we are subject to a legal obligation. For example, we are legally required to retain invoices for accounting purposes. These generally contain personal data.
4. Legitimate interests (Article 6(1)(f) GDPR): Where legitimate interests do not restrict your fundamental rights, we reserve the right to process personal data. For example, we need to process certain data to operate our website securely and economically efficiently. Such processing therefore constitutes a legitimate interest.

Other conditions, such as performing tasks in the public interest, exercising official authority or protecting vital interests, generally do not apply to us. If such a legal basis does apply, it will be identified in the relevant section.

National laws also apply in addition to the EU regulation:

• In Austria, this is the Federal Act on the Protection of Natural Persons with regard to the Processing of Personal Data (Data Protection Act), abbreviated DSG.
• In Germany, the Federal Data Protection Act, abbreviated BDSG, applies.

If further regional or national laws apply, we will inform you in the following sections.

Controller's contact details

If you have questions about privacy or the processing of personal data, you will find the contact details of the responsible person or body below:
GolfAccess
Jeremy Weppler
Franz-Nöbauerweg 10a 4820 Bad Ischl

Email: golfaccessat@gmail.com

Legal notice: https://golfaccess.at/en/policies/legal-notice

Retention period

Our general principle is to store personal data only for as long as absolutely necessary to provide our services and products. This means we delete personal data as soon as the reason for processing it no longer exists. In some cases, we are legally required to retain certain data after its original purpose has ceased, for example for accounting purposes.

If you request the deletion of your data or withdraw your consent to processing, the data will be deleted as quickly as possible, provided no retention obligation applies.

We provide information about the specific duration of each processing activity below where further information is available.

Rights under the General Data Protection Regulation

Under Articles 13 and 14 GDPR, we inform you of the following rights to ensure fair and transparent processing:

• Under Article 15 GDPR, you have the right to know whether we process data about you. If so, you have the right to receive a copy of the data and the following information:
  • the purpose of processing;
  • the categories or types of data processed;
  • who receives the data and, if it is transferred to third countries, how its security can be guaranteed;
  • how long the data is stored;
  • the existence of rights to rectification, erasure or restriction of processing and the right to object;
  • the right to complain to a supervisory authority (links to these authorities appear below);
  • the source of the data if we did not collect it from you;
  • whether profiling takes place, meaning that data is automatically evaluated to create a personal profile of you.
• Under Article 16 GDPR, you have the right to rectification, meaning we must correct data if you find errors.
• Under Article 17 GDPR, you have the right to erasure (“right to be forgotten”), meaning you may request the deletion of your data.
• Under Article 18 GDPR, you have the right to restriction of processing, meaning we may only store the data and may no longer use it.
• Under Article 20 GDPR, you have the right to data portability, meaning we provide your data in a commonly used format upon request.
• Under Article 21 GDPR, you have the right to object, which, when upheld, results in a change to processing.
  • If processing is based on Article 6(1)(e) (public interest or official authority) or Article 6(1)(f) (legitimate interests), you may object. We will then assess as quickly as possible whether we can legally comply.
  • If data is used for direct advertising, you may object to this processing at any time. We may then no longer use your data for direct marketing.
  • If data is used for profiling, you may object to this processing at any time. We may then no longer use your data for profiling.
• Under Article 22 GDPR, in certain circumstances you have the right not to be subject to a decision based solely on automated processing, such as profiling.
• Under Article 77 GDPR, you have the right to complain. You may complain to the data protection authority at any time if you believe the processing of personal data breaches the GDPR.

In brief: You have rights – do not hesitate to contact the responsible person or body listed above!

If you believe the processing of your data breaches data protection law or your data protection rights have otherwise been infringed, you may complain to the supervisory authority. In Austria, this is the Data Protection Authority, whose website is https://www.dsb.gv.at/. In Germany, each federal state has a data protection commissioner. For further information, contact the Federal Commissioner for Data Protection and Freedom of Information (BfDI). The following local data protection authority is responsible for our company:

Introduction to email marketing

Email marketing summary 👥 Data subjects: newsletter subscribers 🤝 Purpose: direct advertising by email, notifications of system-related events 📓 Data processed: data entered during registration, at least the email address. More details are provided for the respective email marketing tool. 📅 Retention period: for the duration of the subscription ⚖️ Legal bases: Article 6(1)(a) GDPR (consent), Article 6(1)(f) GDPR (legitimate interests)

What is email marketing?

We also use email marketing to keep you up to date. If you have agreed to receive our emails or newsletters, data about you is processed and stored. Email marketing is a branch of online marketing in which news or general information about a company, products or services is emailed to a group of interested people.

If you wish to participate in our email marketing, usually through a newsletter, you normally only need to register with your email address by completing and submitting an online form. We may also ask for your title and name so that we can address you personally.

Newsletter registration generally uses the “double opt-in” procedure. After registering on our website, you receive an email through which you confirm your subscription. This ensures that the email address belongs to you and that nobody has registered using another person's address. We or the notification tool we use record every registration. This is necessary to demonstrate that the registration process was legally compliant. Usually, the registration time, confirmation time and your IP address are stored. Changes you make to your stored data are also logged.

Why do we use email marketing?

We want to stay in touch and share the most important news about our company. Email marketing, often simply called a “newsletter”, is therefore an important part of our online marketing. If you consent or if the law permits it, we send newsletters, system emails or other email notifications. In the following text, “newsletter” mainly means regularly sent emails. We do not want to bother you with our newsletters, so we make every effort to offer only relevant and interesting content. You can learn more about our company, services or products. As we continually improve our offers, our newsletter also informs you about developments and special, attractive promotions. If we commission a service provider offering a professional mailing tool, we do so to provide fast and secure newsletters. The basic purpose of our email marketing is to inform you about new offers and help us achieve our business goals.

Which data is processed?

When you subscribe through our website, you confirm your membership of an email list by email. In addition to your IP and email addresses, your title, name, address and telephone number may be stored, but only if you consent to this storage. The data marked as required is necessary to participate in the service. Providing it is voluntary, but without it you cannot use the service. Information about your device or preferred content on our website may also be stored. More information about data stored when visiting a website appears in the “Automatic data storage” section. We record your declaration of consent so that we can always demonstrate that it complies with our laws.

Duration of data processing

If you remove your email address from our email/newsletter mailing list, we may retain it for up to three years on the basis of our legitimate interests so that we can prove your previous consent. We may process this data only if we need to defend ourselves against potential claims.

However, if you confirm that you gave consent to the newsletter subscription, you may submit an individual deletion request at any time. If you permanently object to consent, we reserve the right to store your email address on a suppression list. Naturally, we retain your email address for as long as you voluntarily subscribe to our newsletter.

Right to object

You can cancel your newsletter subscription at any time by withdrawing your consent. This normally takes only a few seconds or one or two clicks. You will usually find an unsubscribe link at the end of each email. If you cannot find it, contact us by email and we will cancel your subscription immediately.

Legal basis

We send our newsletter on the basis of your consent (Article 6(1)(a) GDPR). This means we may send it only if you have actively subscribed beforehand. Where applicable, we may also send advertising messages if you have become our customer and have not objected to the use of your email address for direct advertising.

Information about specific email marketing services and how they process personal data is provided in the following sections, where available.

Explanation of terms used

We always try to make our privacy policy as clear and understandable as possible. This is not always easy, especially with technical and legal topics. It often makes sense to use legal terms, such as personal data, or technical expressions, such as cookies and IP addresses, but we do not want to leave them unexplained. Below is an alphabetical list of important terms that may not have been adequately explained earlier. If the terms are definitions taken from the GDPR, we also include the GDPR wording and, where appropriate, our own explanations.

Processor

Definition under Article 4 GDPR

For the purposes of this Regulation:

“Processor” means a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller;

Explanation: As a company and website owner, we are responsible for all data about you that we process. In addition to controllers, there may be processors: any company or person that processes personal data on our behalf. These may include tax advisers, hosting or cloud providers, payment or newsletter providers, or large companies such as Google or Microsoft.

Consent

Definition under Article 4 GDPR

For the purposes of this Regulation:

“Consent” of the data subject means any freely given, specific, informed and unambiguous indication of the data subject's wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her;

Explanation: On websites, such consent is usually obtained through a cookie consent tool. You are probably familiar with this: when first visiting a website, a banner usually asks whether you agree to data processing. You can generally also make individual settings and decide which processing to allow. If you do not consent, no personal data about you may be processed. Consent can, of course, also be given in writing rather than through a tool.

Personal data

Definition under Article 4 GDPR

For the purposes of this Regulation:

“Personal data” means any information relating to an identified or identifiable natural person (“data subject”); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;

Explanation: Personal data is any data that can identify you as a person. This generally includes:

• name
• address
• email address
• postal address
• telephone number
• date of birth
• identification numbers such as social security, tax identification, identity card or student registration numbers
• bank details such as account numbers, credit information, account balances and more

According to the Court of Justice of the European Union (CJEU), your IP address is also personal data. IT experts can use it to determine at least the approximate location of your device and, subsequently, you as the connection holder. Storing an IP address therefore also requires a legal basis under the GDPR. There are also “special categories” of personal data that deserve particular protection. These include:

• racial and ethnic origin
• political opinions
• religious or philosophical beliefs
• trade union membership
• genetic data, for example from blood or saliva samples
• biometric data (information about mental, physical or behavioural characteristics that can identify a person)
  health data
• data concerning sexual orientation or sex life

Profiling

Definition under Article 4 GDPR

For the purposes of this Regulation:

“Profiling” means any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a natural person, in particular to analyse or predict aspects concerning that person's performance at work, economic situation, health, personal preferences, interests, reliability, behaviour, location or movements;

Explanation: Profiling brings together different information about a person to learn more about them. Online, it is often used for advertising or credit checks. Website or advertising analytics programs, for example, collect data about your behaviour and interests on a website. This creates a specific user profile that can be used to target advertising at an audience.

Controller

Definition under Article 4 GDPR

For the purposes of this Regulation:

“Controller” means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data; where those purposes and means are determined by Union or Member State law, the controller or the specific criteria for its nomination may be provided for by Union or Member State law;

Explanation: In our case, we are responsible for processing your personal data and are therefore the controller. If we pass collected data to other service providers for processing, they are processors. A data processing agreement (DPA) must be signed for this.

Processing

Definition under Article 4 GDPR

For the purposes of this Regulation:

“Processing” means any operation or set of operations performed on personal data or sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction;

Note: When we refer to processing in this privacy policy, we mean any form of data processing. As stated in the original GDPR definition above, this includes not only collecting data but also storing and processing it.

All texts are protected by copyright.

Source: Created using AdSimple's Austria Privacy Policy Generator